Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
31/07/2022, 05:29
Static task
static1
Behavioral task
behavioral1
Sample
zxcvb.exe
Resource
win7-20220718-en
General
-
Target
zxcvb.exe
-
Size
586KB
-
MD5
131a32033cf88976a8df48361b90207d
-
SHA1
ce260393460fa5d4cbfa17d3329fd33594810add
-
SHA256
d75d7b0534ff648f16f5751be79a2c23158b6412a780180aec78c77c7e95071d
-
SHA512
120a4ef120c7b2d4c07af7e6418eaf83d7f3d41ba13f41ce2e494f76182c4b07fd16ec2ceaf1937ba3e76ecb9149cc42edba315e818dad09882cf77a62f6c708
Malware Config
Extracted
raccoon
8a4fd4b44997ba634230ba5c422ca9f2
http://193.106.191.146/
http://185.215.113.89/
Extracted
arkei
Default
Signatures
-
Raccoon Stealer payload 4 IoCs
resource yara_rule behavioral2/memory/2892-141-0x0000000000400000-0x0000000000411000-memory.dmp family_raccoon behavioral2/memory/2892-144-0x0000000000400000-0x0000000000411000-memory.dmp family_raccoon behavioral2/memory/2892-146-0x0000000000400000-0x0000000000411000-memory.dmp family_raccoon behavioral2/memory/2892-151-0x0000000000400000-0x0000000000411000-memory.dmp family_raccoon -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 3704 Mccegjkqnoydj.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation zxcvb.exe -
Loads dropped DLL 5 IoCs
pid Process 2892 InstallUtil.exe 2892 InstallUtil.exe 2892 InstallUtil.exe 212 InstallUtil.exe 212 InstallUtil.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3704 set thread context of 212 3704 Mccegjkqnoydj.exe 88 PID 2172 set thread context of 2892 2172 zxcvb.exe 87 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3704 Mccegjkqnoydj.exe 3704 Mccegjkqnoydj.exe 2172 zxcvb.exe 2172 zxcvb.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2172 wrote to memory of 3704 2172 zxcvb.exe 86 PID 2172 wrote to memory of 3704 2172 zxcvb.exe 86 PID 2172 wrote to memory of 3704 2172 zxcvb.exe 86 PID 2172 wrote to memory of 2892 2172 zxcvb.exe 87 PID 2172 wrote to memory of 2892 2172 zxcvb.exe 87 PID 2172 wrote to memory of 2892 2172 zxcvb.exe 87 PID 3704 wrote to memory of 212 3704 Mccegjkqnoydj.exe 88 PID 3704 wrote to memory of 212 3704 Mccegjkqnoydj.exe 88 PID 3704 wrote to memory of 212 3704 Mccegjkqnoydj.exe 88 PID 3704 wrote to memory of 212 3704 Mccegjkqnoydj.exe 88 PID 3704 wrote to memory of 212 3704 Mccegjkqnoydj.exe 88 PID 3704 wrote to memory of 212 3704 Mccegjkqnoydj.exe 88 PID 3704 wrote to memory of 212 3704 Mccegjkqnoydj.exe 88 PID 3704 wrote to memory of 212 3704 Mccegjkqnoydj.exe 88 PID 3704 wrote to memory of 212 3704 Mccegjkqnoydj.exe 88 PID 2172 wrote to memory of 2892 2172 zxcvb.exe 87 PID 2172 wrote to memory of 2892 2172 zxcvb.exe 87 PID 2172 wrote to memory of 2892 2172 zxcvb.exe 87 PID 2172 wrote to memory of 2892 2172 zxcvb.exe 87 PID 2172 wrote to memory of 2892 2172 zxcvb.exe 87 PID 3704 wrote to memory of 212 3704 Mccegjkqnoydj.exe 88 PID 2172 wrote to memory of 2892 2172 zxcvb.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\zxcvb.exe"C:\Users\Admin\AppData\Local\Temp\zxcvb.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\Mccegjkqnoydj.exe"C:\Users\Admin\AppData\Local\Temp\Mccegjkqnoydj.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Loads dropped DLL
PID:212
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Loads dropped DLL
PID:2892
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 212 -ip 2121⤵PID:4472
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD58f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
Filesize
1.2MB
MD5bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
Filesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
Filesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
Filesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
-
Filesize
341KB
MD5e96634c20057c1643a303d6266321035
SHA15f074a2f48911fa04995ab2bad95f6e66f228ebe
SHA25658ca86e49e4dea36ec81072c6e63fb8d6b465447d3c1fc1443d15e897c13d27c
SHA5120d927b650ef8029636681a4ba16637bda30336756586038818c0b75c2fddba0d83b6e4a51ece8a8c05a4deb13dc93e5bd23ae36024349a901c27909144725ebb
-
Filesize
341KB
MD5e96634c20057c1643a303d6266321035
SHA15f074a2f48911fa04995ab2bad95f6e66f228ebe
SHA25658ca86e49e4dea36ec81072c6e63fb8d6b465447d3c1fc1443d15e897c13d27c
SHA5120d927b650ef8029636681a4ba16637bda30336756586038818c0b75c2fddba0d83b6e4a51ece8a8c05a4deb13dc93e5bd23ae36024349a901c27909144725ebb